1. Field of the Invention
The invention pertains to networks of distributed digital data systems, particularly to methods of managing security keys in such networks when the potential number of combinations of keys may be unmanageably large.
2. Description of the Prior Art
The invention is embodied in an EFTPOS (Electronic Funds Transfer / Point of Sale) system such as the one described in U.S. Pat. No. 4,879,716, "Resilient Data Communications System", issued Nov. 7, 1989 to McNally et al (hereinafter, "the McNally patent").
A large number of point-of-sale (POS) terminals are distributed over a very large geographical area, perhaps on the order of an entire continent. A communications network is provided which transports data over the entire geographical area, and all the POS terminals are connected to it, through telephone lines and intelligent line concentrators (called network access controllers, or "NACs"). Also connected to the communications network are computers operated by financial institutions.
The POS terminals are typically placed into service by merchants, who then accept transactions from consumers who carry plastic credit cards or debit cards which bear in machine-readable form an identification of a financial institution which maintains an account for the consumer, and an identification of that account. The primary function of the system is to forward from the POS terminals to the financial institution computers information identifying a consumer's account and a transaction the consumer wishes to make in that account, and to return from the financial institution to the POS terminal either an acceptance or rejection of that transaction.
A merchant wishing to place a POS terminal into service typically obtains the necessary equipment (the terminals and associated modems, etc.) from a "service provider" organization. Such an organization might have no role in the EFTPOS system beyond that of providing equipment, or larger merchants and financial institutions might function as service providers; in that case the latter role is kept separated from the former.
In addition to line concentrators for POS terminals and computers of financial institutions being connected to the communications network as described above, two other classes of equipment are connected to it which exist ancillarily to the system's aforementioned primary function: network management systems (NMSs), and management workstations (WSs). (WSs are not specifically discussed in the McNally patent, but are at the heart of SAFs 12 and are attached to NMSs 14 to provide an interface between operators and NMSs.)
NMSs are responsible for overall control and monitoring of the EFTPOS system; WSs are used by the network provider organization and service provider organizations to control and monitor particular equipment and communication paths for which they are responsible. As described in the McNally patent, the NACs can be dynamically reconfigured and can report their present status; operators and administrators at the WSs may enter commands to reconfigure the systems or commands requesting information on the current status of the systems. Commands originating at a WS are passed to an NMS for verification that the action or information requested is within the purview of the requesting organization, and are acted upon by the NMS following that verification.
The WSs and NMSs have software running in them to effect the entry of such commands and the responses to them. Each particular type of command typically invokes a particular path through the software, causing the execution of executable paths that are provided to perform particular functions required for a particular command. A software entity dedicated to a discrete function is known in the software arts as a "process".
WSs and NMSs are distributed throughout the geographical area served by the system. The NMS in a particular region of the geographical area generally exercises direct control and monitoring of the POS terminals and NACs in that particular region. A request pertaining to such a terminal or NAC and originating from a process in a WS or NMS in a different region must be forwarded over the communications network to a process in the NMS having cognizance of the target NAC, and a response must be forwarded back to the requesting process.
Software running in the NACs controls the operation of the NACs and, in turn, their control over the terminals and phone lines coming in to the NACs. Communication network 8 may be used for the distribution of new or replacement software from NMSs to the NACs.
Operators at NMSs and WSs potentially have the ability to alter system operational parameters, and to interrogate operational parameters and historical information. In a system whose purpose is to handle a large number of financial transactions, compositely involving enormous amounts of money, these capabilities provide an exposure to potential security problems based on bogus or fraudulent system manipulation. A second area of security exposure inheres in that operators may represent many different, and often competing, business organizations (the national telephone company and local telephone companies, various financial institutions, various service provider organizations, etc.). It can not safely be assumed that there would be no attempts by an operator to access the proprietary information of another organization, or even to sabotage the operations of another organization.
A solution to this problem, well known in the prior art, is to incorporate "locks" in processes that access sensitive or proprietary information, and to require a would-be accesser to present the correct "key" before granting him access. In typical software implementations, this is accomplished by requiring a process initiated at the behest of a would be accesser to present a number or word which must match a number or word known to the process which is being requested to provide access. Ancillarily, presentations of invalid keys may initiate procedures designed to detect attempts at penetration.
An operator upon logging on to an NMS (through a WS colocated with the NMS, or remotely located at an SAF) has presumably passed physical security checks to gain access to those facilities, and is typically further required to know certain passwords controlled by the entities which manage the NMSs and WSs in order to log on. The purpose of the logon checks is to establish the user's identity with a high level of confidence. The user then enjoys a level of access and privilege defined by the keys he has been granted.
The EFTPOS system in which the present invention is embodied is of such complexity that approximately 300 locks are required throughout the system to provide a reasonable assurance of security. The number of key combinations is astronomically high, and would be extremely difficult or perhaps impossible to work with in practice.